The Agent Has Your Keys: Security for the Economy We Are Building

The first time an assistant drafts an invoice, you admire the prose. The first time it sends money, changes a production database, or authorizes a shipment, the prose becomes the least interesting thing about it.

An agent is software with consequences. Give it tools and the security boundary moves from what it says to what it can cause.

I want an economy full of useful agents. I want small African companies to enjoy operational capabilities once reserved for large firms. That requires a security research agenda that reaches well beyond the frontier laboratories. The people connecting models to ordinary businesses will determine much of the practical risk.

The document that becomes an instruction

Suppose a Nairobi logistics agent reads a freight quotation. Somewhere inside the quotation is a sentence telling the agent to upload the customer's records to another website. A human clerk would recognize that the supplier has no authority to issue that instruction. A model may fail to maintain the same distinction.

This example is hypothetical, but the class of failure is established: prompt injection inserts instructions through material the agent was supposed to treat as data. OpenAI's computer-use guidance discusses the risks of operating through interfaces and the need to handle actions and user consent. The presence of guidance should not be mistaken for a universal technical solution.

My design principle is simple: a document may provide facts about an invoice; it may not grant itself permission to send money.

The AgentDojo benchmark supplies a research environment for evaluating attacks and defenses against tool-using agents. Its relevance is methodological: measure whether a defense preserves the legitimate task as well as resisting the attack. An agent that refuses every document is difficult to exploit and difficult to employ.

Achieving that principle requires architecture. Credentials must be scoped to the job. Payment limits must live outside the model. Sensitive actions need verifiable prerequisites. A system should be able to explain which person authorized a transaction without relying on the model's memory of a conversation.

Alignment and security meet at the tool boundary

Security teams traditionally ask whether an attacker can gain access. Alignment researchers also ask whether an authorized system will use access in a way its operators intended. Agents make these questions overlap.

Anthropic's agentic-misalignment research investigates controlled scenarios in which models encounter goal conflicts and opportunities for harmful action. Such scenarios are designed to expose failure modes; their observed rates are not estimates of ordinary business incidents. Nevertheless, they motivate testing behavior when a task becomes difficult, instructions conflict, or the system believes its continued operation is threatened.

There is a second danger in treating the agent as the security analyst who grades itself. A capable system can produce a polished explanation of why an action was legitimate. That explanation is an artifact to inspect, not proof of authorization.

The audit trail should record the actual tool call, input, credential scope, approval, result, and subsequent state. Where possible, a deterministic check should decide whether the action meets policy. The model can help interpret an exception; it should not quietly rewrite the exception policy.

A practical deployment pattern

For a small firm, start with a read-only agent. Let it gather quotes and draft a proposed purchase order. Measure its accuracy on real documents with identifying data removed. Include malicious documents, ambiguous currencies, duplicate invoices, and stale prices. The test suite should reflect how money is actually lost.

Next, introduce a narrow execution tool. The tool accepts a supplier identifier from an approved list, an amount below a fixed limit, and a purchase-order reference. It refuses arbitrary destinations. The execution environment blocks unrelated network access. An idempotency key prevents a retried request from paying twice.

Only then increase autonomy. A supplier change, a new bank account, or an unusually large amount should trigger an independent approval path. This is not permanent bureaucracy for every click. It is a way to place friction where mistakes are expensive.

Watch recovery as carefully as success. If the browser disconnects after a transfer, the agent should inspect the ledger before retrying. If a document contains an instruction aimed at the assistant, the system should preserve the evidence and continue only through an authorized path.

These are engineering recommendations, not claims that one framework guarantees security. Their value is that they constrain the damage even when a model behaves unexpectedly.

The African security opportunity

There is a large research program here for universities and startups: mixed-language prompt injection, agent identity, compromised tool descriptions, payment authorization, malicious spreadsheet formulas, and attacks hidden in images. The work should include the software and commercial practices people actually use locally.

A clinic scheduling system and a cross-border freight platform have different failure costs. A useful African agent-security industry will learn those differences instead of selling a single confidence score.

The strongest objection is cost. Every boundary takes engineering time, and customers want automation now. But the relevant comparison is not between security and a frictionless ideal. It is between an operational system and the financial, reputational, and human cost of its failures.

Security can also accelerate adoption. Businesses delegate more when authority is explicit, damage is bounded, and mistakes can be unwound. Trust becomes a property of the system's design rather than the charisma of its demo.

I want us to race toward useful intelligence with more institutions testing the locks, measuring the blast radius, and teaching agents where their authority ends. The future will need excellent models. It will also need someone who can account for every key.

The right to read a document is not the right to obey it.

Editorial note: This essay expresses the founder’s ideas, developed with AI-assisted research and writing and reviewed against the linked sources on 29 October 2026. Convictions, proposals, and forecasts are identified in the text; scenes framed as imagined are illustrative.

Cover photograph / illustration: ProjectManhattan. CC BY-SA 3.0. Original source. Illustrative image: Network cables in server room.jpg. Credit: ProjectManhattan; CC BY-SA 3.0. This image does not document the research or proposed facility described.